Objective  By the end of this instructional course, users will be able to:  Understand the (basic) concepts of Data Security:  Ensuring data is available.

Similar presentations

Presentation on theme: "Objective  By the end of this instructional course, users will be able to:  Understand the (basic) concepts of Data Security:  Ensuring data is available."— Presentation transcript:

1

2
Objective  By the end of this instructional course, users will be able to:  Understand the (basic) concepts of Data Security:  Ensuring data is available when needed  Maintaining consistent data quality  Protecting data from unauthorized use  Exhibit an understanding of Data Security by:  Identifying the relevant laws which apply to Data Security  Detecting examples of gaps in Data Security  Recognizing strong Data Security policy

3
Data Security isn’t just good practice…it’s the law. Specifically, there are two important pieces of legislation you need to be familiar with:  Health Insurance Portability and Accountability Act of 1996 (HIPAA)  Requires Covered Entities to comply with regulations regarding the privacy and security of healthcare information.   Health Information Technology for Economic and Clinical Health (HITECH) Act  Addresses the privacy and security concerns associated with the electronic transmission of health information 1. These two pieces of legislation for the basis of our data security policy, so be familiar with them!

4
Data Security can be easy, just remember the acronym CIA. Confidentiality – ensure electronic protected health information is not made available or disclosed to unauthorized persons or processes. Integrity– make sure electronic protected health information is not altered or destroyed in any manner. Availability – make sure that electronic protected health information is accessible and usable upon demand by authorized users. (click each letter to see its meaning)

5
What are the names of the two pieces of legislation on which our company data security policies are based? HIPPO and HILITE HIPAA and HITECH CIA and FBI

6
What are the names of the two pieces of legislation on which our company data security policies are based? HIPPO and HILITE HIPAA and HITECH CIA and FBI Why is this incorrect? Try again.

7
What are the names of the two pieces of legislation on which our company data security policies are based? HIPPO and HILITE HIPAA and HITECH CIA and FBI Why is this incorrect? Try again.

8
What are the names of the two pieces of legislation on which our company data security policies are based? HIPPO and HILITE HIPAA and HITECH CIA and FBI The Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH) are what our data security policies are based on.

9
Usernames and passwords identify you as a registered user and allows the company to know who is using a computer and when. To ensure protection for both you and the company:  Log in using only your assigned username and password; do not “borrow” passwords  Log off or lock your PC when it is not in use or when you are away from it  Do not leave your password written down anywhere where it can be found  If it is necessary to write down your password for you to remember it, keep it in a locked drawer or cabinet

10
Creating a strong password is one of the best ways to ensure confidential information is protected. A strong password is not something that is easily guessed. Do not use any of the following for a password:  Birthdates  Addresses  Family names

11
A weak password can easily be strengthened with a few small tweaks. Try replacing certain letters with numbers or symbols (known as 1337 –or- Leet), or phonetically similar letter combinations. This creates a unique password which is memorable for the user, but difficult to be cracked by hackers. A = #O = 0V + \/ B = 8I = !P = |DW = \/\/ C = < D = >K = |

13
Joe Smith works in the office across from you. He has two children: Bob Michael and Joe Junior. He recently changed his password to ‘BobandJoeJr’, and his account was hacked into later in the week. After resolving the issue, Joe was instructed to create a new, safer, password. He complied and his new password comprised of letters and numbers with no discernible meaning other than to Joe. Joe then wrote down his new password and hid it under his stapler. Later in the week, his co-worker Jim was locked out of his PC and needed to finish an important document. Joe told Jim to retrieve his password and log in to his PC to finish his work. With the document * Some information has been changed in this scenario. complete, Jim logged off Joe’s computer and eventually regained his own access. Since then, each individual has been working with no issues.

14
Given the information presented in the case study, were the following actions appropriate ( ) or inappropriate ( )? Using ‘BobandJoeJR’ as his password Appropriate Inappropriate Try again! Correct. This password is too apparent, it should be comprised of letters and numbers with no obvious reason other than to the user. Why is this inappropriate? View case study information (click on either the Appropriate or Inappropriate icon)

15
Given the information presented in the case study, were the following actions appropriate ( ) or inappropriate ( )? Creating a new, unique password comprised of letters and numbers Appropriate Inappropriate Try again! Correct. Using a combination of letters and numbers to create a password is good policy. These types of passwords are not easily guessed. Why is this appropriate? View case study information (click on either the Appropriate or Inappropriate icon)

16
Given the information presented in the case study, were the following actions appropriate ( ) or inappropriate ( )? Writing down his password and hiding it under his stapler Appropriate Inappropriate Try again! Correct. If you must write down your password, ensure it is in a locked space such as a drawer or cabinet. Why is this inappropriate? View case study information (click on either the Appropriate or Inappropriate icon)

17
Given the information presented in the case study, were the following actions appropriate ( ) or inappropriate ( )? Allowing a co-worker to use his login information Appropriate Inappropriate Try again! Correct. Never use another person’s login information. Why is this inappropriate? View case study information (click on either the Appropriate or Inappropriate icon)

18
Malicious software exists for the sole purpose of harming your computer. These programs attack the confidentiality, integrity, and availability of your information. Malicious software can include: (click on each for more information)  Viruses  Worms  Trojans  Spyware Viruses: Small programs that attach themselves to legitimate programs. When activated by an unwary user, it begins performing tasks given to it by its creator. Viruses can corrupt files and delete data. Worm: Similar to a virus, a worm replicates itself and usually contains functionality that interferes with normal computer use. Unlike viruses, worms do not attach themselves to other files or programs. Worms can spread automatically over a network, moving from one computer to another, causing massive damage. Trojan: Short for Trojan Horse, a Trojan pretends to be a legitimate program while actually performing malicious tasks. Trojans can cause damage to your PC and provide unauthorized use. Spyware: Spyware sneaks onto your PC through shareware or freeware downloaded by the user. Once on a computer, spyware gathers information about the user and sends it back to its creator. Spyware can capture addresses, passwords, credit card information, and much more.

19
Choose the answer that best fits. A ______________ pretends to be a legitimate program while secretly performing malicious tasks. Virus Worm Trojan Spyware

20
Choose the answer that best fits. A ______________ pretends to be a legitimate program while secretly performing malicious tasks. Virus Worm Trojan Spyware Why is this incorrect? Try again.

21
Choose the answer that best fits. A ______________ pretends to be a legitimate program while secretly performing malicious tasks. Virus Worm Trojan Spyware Why is this incorrect? Try again.

22
Choose the answer that best fits. A ______________ pretends to be a legitimate program while secretly performing malicious tasks. Virus Worm Trojan Spyware Why is this incorrect? Try again.

23
Choose the answer that best fits. A ______________ pretends to be a legitimate program while secretly performing malicious tasks. Virus Worm Trojan Spyware Also known as a Trojan Horse, a trojan can appear to be a genuine program, but actually causes hard to your computer.

24
Choose the answer that best fits. A ______________ replicates itself and contains functionality that interferes with a PC’s normal use and can spread over a network to other computers Virus Worm Trojan Spyware

25
Virus Worm Trojan Spyware Why is this incorrect? Try again. Choose the answer that best fits. A ______________ replicates itself and contains functionality that interferes with a PC’s normal use and can spread over a network to other computers

26
Why is this incorrect? Try again. Choose the answer that best fits. A ______________ replicates itself and contains functionality that interferes with a PC’s normal use and can spread over a network to other computers Virus Worm Trojan Spyware

27
Why is this incorrect? Try again. Choose the answer that best fits. A ______________ replicates itself and contains functionality that interferes with a PC’s normal use and can spread over a network to other computers Virus Worm Trojan Spyware

28
Worms are similar to viruses, and can replicate and spread across a network to spread itself onto other computers. Choose the answer that best fits. A ______________ replicates itself and contains functionality that interferes with a PC’s normal use and can spread over a network to other computers Virus Worm Trojan Spyware

29
To prevent your computer from becoming infected with malicious software, follow these steps:  Never open attachments or download/execute files from unknown sources.  If you are unsure of the sender or wary of their identity, err on the side of caution. Call or the suspected sender to verify the information being sent.  Do not install any unauthorized toolbars or other “helpful” programs, unless otherwise approved  Do not disable any antivirus software installed on your PC

30
Suppose the inbox below is yours. Click on each to learn whether or not it should be opened.

31
Sender: John Co-worker Subject: Regarding our 2:00 meeting today This is OK to be opened. You had a 2:00 meeting scheduled with John, and he mentioned being excessively busy this week. In other words, you could adequately anticipate an from John. Return to the inbox

32
Sender: Prince Abu-Zyed et Al Subject: Amazing business opportunity This should not be opened. You have never heard of this person before, and weren’t expecting any new “business opportunities.” This could an example of “phishing,” when people attempt to gain personal information through trickery. Additionally, the could contain a virus which could harm your computer. Click here to learn more about phishing.here Return to the inbox

33
Sender: Human Resources Subject: New employee conduct manual This can be opened. You regularly receive s from Human Resources at this address, and it’s the time of year when their documentation is updated. Return to the inbox

34
Sender: Subject: Urgent Response Requested Do not open this . Despite having “Urgent Response Required” in the subject line, you have never heard of Very often fraudulent s contain keywords like “urgent” or references to new/changing laws in their subject line. If you do not know the sender, do not open the . Return to the inbox

35
Sender: Suzy Co-worker Subject: Download this cool free screensaver! Despite the fact that you know Suzy, this should not be opened. You work with Suzy every day, and she hasn’t ever mentioned sending you any software. Additionally, installing unauthorized software (like a screensaver) is against company policy. The file could be a Trojan Horse and could damage your PC. Return to the inbox

36
Sender: Steve Johnson Subject: How about a game of golf after work? This can be opened. Steve is your boss, and an avid golfer; and he has mentioned wanting to play with you. Although the didn’t come from his company account, you could reasonably assume is came from him as you know he is out of the office today. If in doubt, give him a call to confirm the came from him. Return to the inbox

37
Phishing is a term that refers to an act when someone sends an seemingly legitimate , claiming to be from your credit card company, bank, or online store you have shopped at. The goal of phishing is to gain personal, private information such as social security numbers or bank information (account numbers, ATM pin codes). Actual companies will never ask for this information, they have it on file. Often times, links within the lead to “spoof” websites. Spoof sites are designed to look like those of actual companies, but are used to gain access to your personal information. Click here to learn even more about phishing.here

38
When sending containing confidential information, you must use an Advanced Encryption Standard (AES) to encrypt the data. One of the most common AES’s is WinZip. To ensure your confidential information is secure: 1.Encrypt and password protect the file using WinZip. 2. the encrypted files as an attachment. 3.In a separate , send the recipient the password to the encrypted file.

39
True of False? The below is most likely a phishing attempt, and should be ignored. True False

40
True of False? The below is most likely a phishing attempt, and should be ignored. True False Why is this incorrect? Try again.

41
True of False? The below is most likely a phishing attempt, and should be ignored. True False Reputable companies (such as banks) will never ask for personal information via . This should be deleted.

42
Confidential data must to be stored on a network drive or on your secured company-approved thumb drive. Do not store confidential information on your local computer C drive, unauthorized external flash drive, or CD. Personal mobile devices (laptops, tablets, smartphones, etc.) can store confidential information if approved by the Security Officer. These devices must meet minimum encryption standards to be approved.

43
All technology containing confidential information must be properly destroyed. For floppy disks and CDs, utilize a multimedia shredder. If a shredder is not available, deposit the item in one of the shred bins located in your building. For laptops, desktops, and mobile devices, the security team will employ a number of methods (multiple rewrites, low-level formats) to ensure data is properly disposed of. When in doubt, contact the security team. It is better to be safe than sorry when it comes do confidential material.

44
Choose the best answer. Your personal cell phone was approved for company use, and you’ve used it to view work-related containing confidential information. Now, your contract is up and you want to buy a new phone. What should you do? Remove your SIM card and donate your old phone to a school or charitable organization. Contact the Security Officer and have them take care of disposing the phone properly. Take your phone outside, stomp on it, drive over it with your car, then throw it into a dumpster.

45
Why is this incorrect? Try again. Choose the best answer. Your personal cell phone was approved for company use, and you’ve used it to view work-related containing confidential information. Now, your contract is up and you want to buy a new phone. What should you do? Remove your SIM card and donate your old phone to a school or charitable organization. Contact the Security Officer and have them take care of disposing the phone properly. Take your phone outside, stomp on it, drive over it with your car, then throw it into a dumpster.

46
Choose the best answer. Your personal cell phone was approved for company use, and you’ve used it to view work-related containing confidential information. Now, your contract is up and you want to buy a new phone. What should you do? Remove your SIM card and donate your old phone to a school or charitable organization. Contact the Security Officer and have them take care of disposing the phone properly. Take your phone outside, stomp on it, drive over it with your car, then throw it into a dumpster. Even after removing a SIM card or severely damaging an electronic device, data can still be recovered. The Security Officer will ensure all the necessary measures are taken to remove confidential data from your phone.

47
Why is this incorrect? Try again. Choose the best answer. Your personal cell phone was approved for company use, and you’ve used it to view work-related containing confidential information. Now, your contract is up and you want to buy a new phone. What should you do? Remove your SIM card and donate your old phone to a school or charitable organization. Contact the Security Officer and have them take care of disposing the phone properly. Take your phone outside, stomp on it, drive over it with your car, then throw it into a dumpster.

48
You’ve received a file containing confidential information. Select the secure, approved location where the file should be saved

49
Why is this incorrect? Try again. You’ve received a file containing confidential information. Select the secure, approved location where the file should be saved

50
You’ve received a file containing confidential information. Select the secure, approved location where the file should be saved Why is this incorrect? Try again.

51
You’ve received a file containing confidential information. Select the secure, approved location where the file should be saved Why is this incorrect? Try again.

52
You’ve received a file containing confidential information. Select the secure, approved location where the file should be saved Why is this incorrect? Try again.

53
You’ve received a file containing confidential information. Select the secure, approved location where the file should be saved Confidential information should never be stored on a local drive. Given your choices, the file should only have been saved on the (company-approved) flash drive. If a network drive were available, this would have also been an approved option.

54
Returning to your desk after meeting with the Accounting department, you notice you have received three new messages. Using the information you’ve learned, choose to open or delete the messages by clicking on the appropriate buttons. To begin the exercise, click the mail icon below.

55
(click Delete or Open)

56
Given that you just came from a meeting with the Accounting department, it is reasonable to expect an from them. It is OK to open this . Why is this incorrect? Try again.

57
Given that you just came from a meeting with the Accounting department, it is reasonable to expect an from them. It is OK to open this .

58
(click Delete or Open)

59
The address is vague, and most likely one you’ve never seen before. Additionally, the Subject of the message is not work related. This should not be opened, delete it. Why is this incorrect? Try again.

60
The address is vague, and most likely one you’ve never seen before. Additionally, the Subject of the message is not work related. This should not be opened, delete it.

61
(click Delete or Open)

62
Unless an attachment comes from a verified source, they should never be opened. Antivirus software will always come from the Security team. Why is this incorrect? Try again.

63
Unless an attachment comes from a verified source, they should never be opened. Antivirus software will always come from the Security team. This should be deleted!